This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-40346 →

DEBIAN-CVE-2021-40346

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an...

Original description

The description as published by the source.

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 haproxy

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-3"}]}]

Debian:13 haproxy

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-3"}]}]

Debian:14 haproxy

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-3"}]}]

References

advisory security-tracker.debian.org